opencode-swarm 7.153.1 → 7.154.0

package/dist/commands/pr-monitor-status.d.ts

@@ -9,7 +9,7 @@
  * Input contract (no args):
  *   /swarm pr status                              → show session subscriptions
  */
-import { listActive } from '../background/pr-subscriptions.js';
+import { getPrSubscriptionHealth, listActive, type PrSubscriptionHealth } from '../background/pr-subscriptions.js';
 type MergeGroupRun = {
     databaseId: number;
     headBranch: string;
@@ -38,15 +38,22 @@ declare function listMergeGroupRuns(directory: string, repoFullName: string, prN
  * and a link reference.
  */
 declare function formatMergeGroupStatus(status?: string, conclusion?: string, htmlUrl?: string): string;
+/**
+ * Format the bounded-store storage-health footer (issue #2042). Counts and
+ * bytes only — never a path or repo identity.
+ */
+declare function formatStorageHealth(health: PrSubscriptionHealth): string;
 /**
  * Exposed for unit testing via _internals.
  */
 export declare const _internals: {
     formatRelativeTime: typeof formatRelativeTime;
     formatMergeGroupStatus: typeof formatMergeGroupStatus;
+    formatStorageHealth: typeof formatStorageHealth;
     listActive: typeof listActive;
     listMergeGroupRuns: typeof listMergeGroupRuns;
     parseMergeGroupRuns: typeof parseMergeGroupRuns;
+    getPrSubscriptionHealth: typeof getPrSubscriptionHealth;
 };
 /**
  * Show PR monitor subscription status for the current session.

package/dist/commands/registry.d.ts

@@ -845,7 +845,7 @@ export declare const COMMAND_REGISTRY: {
     readonly 'reset-session': {
         readonly handler: (ctx: CommandContext) => Promise<string>;
         readonly description: "Clear session state while preserving plan, evidence, and knowledge";
-        readonly details: "Deletes only .swarm/session/state.json and any other session files. Clears in-memory agent sessions, delegation chains, and active-agent mappings. Preserves plan, evidence, and knowledge for cross-session continuity. Also recovers stale coder settlements, releasing in-flight ownership held by this process, so dispatches cannot stay wedged on CODER_DISPATCH_IN_PROGRESS (issue #2268). Before deleting, auto-backs up the session files it removes to .swarm/reset-backups/<timestamp>/ (newest 5 kept).";
+        readonly details: "Deletes only .swarm/session/state.json and other session files. Clears in-memory agent sessions, delegation chains, and active-agent mappings. Preserves plan, evidence, and knowledge. Also releases this session's pending knowledge-gate obligations (#2398) and recovers stale coder settlements so dispatches cannot wedge on CODER_DISPATCH_IN_PROGRESS (#2268). Auto-backs up removed files to .swarm/reset-backups/ (newest 5 kept).";
         readonly args: "";
         readonly category: "utility";
         readonly toolPolicy: "restricted";

package/dist/commands/reset-session.d.ts

@@ -1,3 +1,4 @@
+import { commitGateReleaseBatch, queryLiveMemberships } from '../hooks/knowledge-receipt-ledger';
 import { recoverStaleCoderSettlements } from '../workflow/coder-settlement.js';
 import { type OrphanCleanupResult } from '../worktree/merge';
 import { type ResetBackupResult } from './reset-backup';
@@ -11,11 +12,16 @@ export declare const _internals: {
     cleanupOrphanedBranches: (directory: string, activeSessionIds: string[]) => Promise<OrphanCleanupResult>;
     backupSwarmStateBeforeReset: (directory: string, kind: 'reset' | 'reset-session', relEntries: string[]) => ResetBackupResult;
     recoverStaleCoderSettlements: typeof recoverStaleCoderSettlements;
+    queryLiveMemberships: typeof queryLiveMemberships;
+    commitGateReleaseBatch: typeof commitGateReleaseBatch;
+    releaseKnowledgeGateObligations: (directory: string, sessionID: string) => Promise<string[]>;
 };
 /**
  * Handles the /swarm reset-session command.
  * Deletes only the session state file (.swarm/session/state.json)
  * and clears in-memory agent sessions. Preserves plan, evidence,
- * and knowledge for continuity across sessions.
+ * and knowledge for continuity across sessions — but DOES release this
+ * session's pending knowledge-application gate obligations (issue #2398) so
+ * the reset is a real escape from an enforce-mode lockout.
  */
-export declare function handleResetSessionCommand(directory: string, _args: string[]): Promise<string>;
+export declare function handleResetSessionCommand(directory: string, _args: string[], sessionID?: string): Promise<string>;

package/dist/config/schema.d.ts

@@ -1755,6 +1755,12 @@ export interface PrReviewResilienceConfig {
     status_probe_timeout_ms: number;
     correlated_failure_threshold: number;
     max_retry_attempts_after_initial: number;
+    /**
+     * Issue #2382: how long an opened PR-review resilience circuit stays OPEN
+     * before it admits exactly one HALF_OPEN probe. Applies both to the initial
+     * open and to every provider-failure reopen.
+     */
+    circuit_open_duration_ms: number;
 }
 /**
  * Issue #2381: staged PR-review resilience defaults OFF while the #2380 repair
@@ -1770,6 +1776,7 @@ export declare const PrReviewResilienceConfigSchema: z.ZodObject<{
     status_probe_timeout_ms: z.ZodDefault<z.ZodNumber>;
     correlated_failure_threshold: z.ZodDefault<z.ZodNumber>;
     max_retry_attempts_after_initial: z.ZodDefault<z.ZodNumber>;
+    circuit_open_duration_ms: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strict>;
 export declare const PluginConfigSchema: z.ZodObject<{
     config_format_version: z.ZodDefault<z.ZodNumber>;
@@ -1866,6 +1873,7 @@ export declare const PluginConfigSchema: z.ZodObject<{
         status_probe_timeout_ms: z.ZodDefault<z.ZodNumber>;
         correlated_failure_threshold: z.ZodDefault<z.ZodNumber>;
         max_retry_attempts_after_initial: z.ZodDefault<z.ZodNumber>;
+        circuit_open_duration_ms: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strict>>;
     gates: z.ZodOptional<z.ZodObject<{
         syntax_check: z.ZodDefault<z.ZodObject<{

package/dist/hooks/knowledge-application-gate.d.ts

@@ -30,13 +30,22 @@
  *   - update_task_status
  *   - phase_complete
  *   - Task (delegations to coder/reviewer/test_engineer/sme/docs/designer)
+ *   - skill_regenerate
+ *   - skill_retire
  *
  * Non-architect agents are never gated.
  */
 import { type KnowledgeApplicationConfig } from './knowledge-application.js';
 import { type ReceiptMembership } from './knowledge-receipt-ledger.js';
 import type { MessageWithParts } from './knowledge-types.js';
-/** Tools that require knowledge-directive acknowledgment before execution. */
+/**
+ * Fallback set used only when `config.high_risk_tools` is absent. The parsed
+ * config schema (`KnowledgeApplicationConfigSchema`) defaults
+ * `high_risk_tools` to a 5-tool list (save_plan, update_task_status,
+ * phase_complete, task, Task) that is always populated post-parse, so this
+ * constant is shadowed in practice and `skill_regenerate` / `skill_retire`
+ * are NOT gated unless the operator's config lists them explicitly.
+ */
 export declare const HIGH_RISK_TOOLS: Set<string>;
 export interface GateInput {
     tool: unknown;

package/dist/hooks/knowledge-receipt-ledger.d.ts

@@ -27,7 +27,7 @@ export declare const RECEIPT_TERMINAL_OUTCOMES: ReadonlySet<ReceiptOutcome>;
  * preserved as `'unknown'` and is never coerced to delegate, ignored, or any
  * other class. New producers must stamp one of the closed values below.
  */
-export type ReceiptSourceCode = 'delegate' | 'reviewer' | 'architect' | 'architect_marker' | 'test_engineer' | 'phase_override' | 'application_gate_staleness_release' | 'application_gate_denial_limit_release' | 'manual' | 'migration' | 'unknown';
+export type ReceiptSourceCode = 'delegate' | 'reviewer' | 'architect' | 'architect_marker' | 'test_engineer' | 'phase_override' | 'application_gate_staleness_release' | 'application_gate_denial_limit_release' | 'application_gate_session_reset_release' | 'manual' | 'migration' | 'unknown';
 /** Closed set form of {@link ReceiptSourceCode}. */
 export declare const CANONICAL_RECEIPT_SOURCES: ReadonlySet<string>;
 /**

package/dist/hooks/pr-review-resilience-circuit.d.ts

@@ -0,0 +1,232 @@
+/**
+ * PR-review resilience circuit — typed, recoverable, versioned (issue #2382).
+ *
+ * Pure state machine + typed-signal classification for the PR_REVIEW
+ * resilience circuit. No I/O: the owning gate (`pr-workflow-gate.ts`) reads
+ * the delegation ledger and persists transitions under its CAS write path.
+ *
+ * Contracts implemented (issue #2382 "Required design"):
+ * - Only durable, typed `provider_terminal` signals contribute; every other
+ *   outcome is an `ignored` kind that can never open, reopen, or close the
+ *   circuit.
+ * - The threshold counts distinct `(generation, batchId, laneId)` contributor
+ *   lanes per provider class — never owned dimensions, never repeated
+ *   collections of the same lane.
+ * - State is a versioned v2 record: CLOSED → OPEN (bounded interval) →
+ *   exactly-one HALF_OPEN probe → CLOSED (generation bump + evidence
+ *   waterline) or back to OPEN (new interval). Legacy unversioned records
+ *   migrate once to a nonblocking v2 CLOSED record with an evidence waterline;
+ *   malformed records fail open.
+ */
+import { z } from 'zod';
+import type { BackgroundDelegationRecord } from '../background/pending-delegations.js';
+/** Bounded contributor ledger. Mirrors `MAX_WORKFLOW_BATCHES (128) × 6` base dimensions. */
+export declare const PR_REVIEW_CIRCUIT_CONTRIBUTOR_LIMIT = 768;
+export type PrReviewCircuitIgnoredReason = 'observer_deadline' | 'client_unavailable' | 'parser' | 'validation' | 'policy' | 'filesystem' | 'git' | 'cancellation' | 'stale_observation' | 'unknown';
+export type PrReviewCircuitSignal = {
+    kind: 'provider_terminal';
+    providerClass: string;
+    batchId: string;
+    laneId: string;
+    terminalAtMs: number;
+} | {
+    kind: 'ignored';
+    reason: PrReviewCircuitIgnoredReason;
+};
+export type PrReviewCircuitState = 'CLOSED' | 'OPEN' | 'HALF_OPEN';
+export interface PrReviewCircuitContributor {
+    batchId: string;
+    laneId: string;
+    /** ISO timestamp of the contributing lane's terminal evidence. */
+    terminalAt: string;
+}
+export interface PrReviewCircuitProbeRecord {
+    batchId: string;
+    laneId: string;
+    admittedAt: string;
+}
+export interface PrReviewCircuitRecordV2 {
+    version: 2;
+    state: PrReviewCircuitState;
+    generation: number;
+    providerClass?: string;
+    contributors: PrReviewCircuitContributor[];
+    openedAt?: string;
+    openUntil?: string;
+    /** Evidence at or before this ISO instant can never contribute again. */
+    evidenceWaterline?: string;
+    probe?: PrReviewCircuitProbeRecord;
+}
+/** The unversioned pre-#2382 persisted circuit shape. */
+export interface PrReviewCircuitLegacyRecord {
+    signature: string;
+    count: number;
+    contributors: Array<{
+        batchId: string;
+        laneId: string;
+    }>;
+    openedAt: string;
+}
+export declare const PrReviewCircuitLegacyRecordSchema: z.ZodObject<{
+    signature: z.ZodString;
+    count: z.ZodNumber;
+    contributors: z.ZodArray<z.ZodObject<{
+        batchId: z.ZodString;
+        laneId: z.ZodString;
+    }, z.core.$strict>>;
+    openedAt: z.ZodString;
+}, z.core.$strict>;
+export declare const PrReviewCircuitRecordV2Schema: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    state: z.ZodEnum<{
+        CLOSED: "CLOSED";
+        OPEN: "OPEN";
+        HALF_OPEN: "HALF_OPEN";
+    }>;
+    generation: z.ZodNumber;
+    providerClass: z.ZodOptional<z.ZodString>;
+    contributors: z.ZodArray<z.ZodObject<{
+        batchId: z.ZodString;
+        laneId: z.ZodString;
+        terminalAt: z.ZodString;
+    }, z.core.$strict>>;
+    openedAt: z.ZodOptional<z.ZodString>;
+    openUntil: z.ZodOptional<z.ZodString>;
+    evidenceWaterline: z.ZodOptional<z.ZodString>;
+    probe: z.ZodOptional<z.ZodObject<{
+        batchId: z.ZodString;
+        laneId: z.ZodString;
+        admittedAt: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const PrReviewCircuitRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
+    signature: z.ZodString;
+    count: z.ZodNumber;
+    contributors: z.ZodArray<z.ZodObject<{
+        batchId: z.ZodString;
+        laneId: z.ZodString;
+    }, z.core.$strict>>;
+    openedAt: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    state: z.ZodEnum<{
+        CLOSED: "CLOSED";
+        OPEN: "OPEN";
+        HALF_OPEN: "HALF_OPEN";
+    }>;
+    generation: z.ZodNumber;
+    providerClass: z.ZodOptional<z.ZodString>;
+    contributors: z.ZodArray<z.ZodObject<{
+        batchId: z.ZodString;
+        laneId: z.ZodString;
+        terminalAt: z.ZodString;
+    }, z.core.$strict>>;
+    openedAt: z.ZodOptional<z.ZodString>;
+    openUntil: z.ZodOptional<z.ZodString>;
+    evidenceWaterline: z.ZodOptional<z.ZodString>;
+    probe: z.ZodOptional<z.ZodObject<{
+        batchId: z.ZodString;
+        laneId: z.ZodString;
+        admittedAt: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>]>;
+/**
+ * Derive the typed circuit signal from a durable delegation record's LATEST
+ * terminal state. Returns `null` for anything that is not a terminal failure
+ * signal (pending/running lanes, healthy completions).
+ *
+ * Trust rules: only the structured `terminalErrorClass` captured at settle
+ * time can produce `provider_terminal`; display text is never parsed. Records
+ * settled before this field existed, launch failures (the child never ran),
+ * presumed-stale sweeps, cancellations, and empty completions are `ignored`
+ * kinds or no signal at all.
+ */
+export declare function classifyPrReviewCircuitSignal(record: Pick<BackgroundDelegationRecord, 'status' | 'result' | 'terminalResult'> & {
+    batchId?: string;
+    laneId?: string;
+}): PrReviewCircuitSignal | null;
+/**
+ * Reduce per-lane signals into per-providerClass distinct-lane evidence under
+ * the CURRENT circuit generation. Dedupes on `(generation, batchId, laneId)`,
+ * drops evidence at or before the waterline, sorts newest-first, and bounds
+ * each class's contributor list with deterministic keep-newest eviction.
+ */
+export declare function scanPrReviewCircuitEvidence(signals: readonly PrReviewCircuitSignal[], generation: number, waterlineMs: number | undefined): Map<string, Array<PrReviewCircuitSignal & {
+    kind: 'provider_terminal';
+}>>;
+export type PrReviewCircuitAdoptionDiagnostic = {
+    code: 'migrated_legacy_circuit';
+    legacySignatureCount: number;
+} | {
+    code: 'malformed_circuit_dropped';
+    bodyHash8: string;
+    byteLength: number;
+};
+export type PrReviewCircuitAdoption = {
+    kind: 'v2';
+    record: PrReviewCircuitRecordV2;
+} | {
+    kind: 'absent';
+} | {
+    kind: 'migrated';
+    record: PrReviewCircuitRecordV2;
+    diagnostic: PrReviewCircuitAdoptionDiagnostic;
+} | {
+    kind: 'malformed';
+    diagnostic: PrReviewCircuitAdoptionDiagnostic;
+};
+/**
+ * Adopt a persisted circuit field: v2 records pass through, legacy unversioned
+ * records migrate ONCE to a nonblocking v2 CLOSED record whose evidence
+ * waterline is `now` (historical evidence can never immediately reopen), and
+ * malformed records fail open with a bounded hash-only diagnostic.
+ */
+export declare function adoptPrReviewCircuit(raw: unknown, nowMs: number): PrReviewCircuitAdoption;
+export interface PrReviewCircuitAdvanceInput {
+    nowMs: number;
+    threshold: number;
+    openDurationMs: number;
+    /** The staged dispatch requesting admission, when this advance guards one. */
+    admission?: {
+        batchId: string;
+        laneId: string;
+    };
+    /** Latest-record signals for every dispatch lane of the current workflow. */
+    laneSignals: readonly PrReviewCircuitSignal[];
+    /**
+     * Observation of the CURRENT probe lane's latest record (HALF_OPEN only).
+     * The gate supplies it only when it read the recorded probe's batch/lane,
+     * which structurally drops late results from older generations.
+     */
+    probeObservation?: {
+        terminalStatus: string;
+        signal: PrReviewCircuitSignal | null;
+        terminalAtMs: number;
+    };
+}
+export type PrReviewCircuitAdvanceResult = {
+    action: 'admit';
+    changed: false;
+} | {
+    action: 'admit';
+    changed: true;
+    record: PrReviewCircuitRecordV2;
+} | {
+    action: 'admit_as_probe';
+    changed: true;
+    record: PrReviewCircuitRecordV2;
+} | {
+    action: 'admit_as_probe';
+    changed: false;
+} | {
+    action: 'block';
+    reason: 'circuit_open' | 'probe_in_flight';
+    changed: boolean;
+    record?: PrReviewCircuitRecordV2;
+};
+/**
+ * Advance the circuit one step. `current === null` means no circuit record
+ * exists yet (plain birth: no waterline — post-upgrade evidence counts; the
+ * gate passes an explicit waterlined record for migration / re-enable births).
+ */
+export declare function advancePrReviewCircuit(current: PrReviewCircuitRecordV2 | null, input: PrReviewCircuitAdvanceInput): PrReviewCircuitAdvanceResult;

package/dist/hooks/pr-workflow-gate.d.ts

@@ -7,6 +7,7 @@ import { type PrReviewInlineTriggerRow } from '../background/pr-review-trigger-c
 import { type RevisionDigestResult, resolveCommitCountSince, resolveCommitCountSinceAsync, resolveCurrentGitHead, resolveCurrentGitHeadAsync, resolveCurrentUpstreamPushTarget, resolveCurrentUpstreamPushTargetAsync, resolveCurrentUpstreamRemoteRef, resolveExactRemoteBranchHead, resolveExactRemoteBranchHeadAsync, resolveIsExactSingleChildCommit, resolveIsExactSingleChildCommitAsync, resolveIsWorkingTreeClean, resolveIsWorkingTreeCleanAsync, resolvePrReviewDiffStats, resolvePrReviewDiffStatsAsync, resolvePrWorkflowRevisionDigest, resolvePrWorkflowRevisionDigestDetailed, resolveRemoteRefsContainingHead, resolveRemoteRefsContainingHeadAsync } from '../background/workspace-snapshot.js';
 import { type PrReviewResilienceConfig } from '../config/schema.js';
 import { classifyPrWorkflowGitState, type PrWorkflowGitState } from '../git/pr-workflow-state.js';
+import { classifyPrReviewCircuitSignal, type PrReviewCircuitLegacyRecord, type PrReviewCircuitRecordV2 } from './pr-review-resilience-circuit.js';
 export declare const PR_REVIEW_BASE_DIMENSION_IDS: readonly ["intent-architecture", "correctness-state", "tests-falsifiability", "security-trust", "reliability-performance", "compatibility-delivery"];
 export declare const PR_REVIEW_REQUIRED_MICRO_LANE_IDS: ("auth-identity-secrets" | "untrusted-input-boundaries" | "subprocess-platform" | "concurrency-state" | "dependencies-build-release" | "api-schema-migrations" | "test-infrastructure" | "ui-accessibility-i18n" | "privacy-observability" | "generated-provenance" | "unclassified-risk")[];
 export type PrReviewBaseDimensionId = (typeof PR_REVIEW_BASE_DIMENSION_IDS)[number];
@@ -176,6 +177,8 @@ interface PrReviewResiliencePolicyRecord {
     statusProbeTimeoutMs: number;
     correlatedFailureThreshold: number;
     maxRetryAttemptsAfterInitial: number;
+    /** Issue #2382. Optional: policies persisted before the field existed parse unchanged. */
+    circuitOpenDurationMs?: number;
 }
 interface PrReviewResilienceAttemptRecord {
     attempt: 0 | 1 | 2;
@@ -186,15 +189,12 @@ interface PrReviewResilienceAttemptRecord {
     admittedAt: string;
     fanoutBatchId?: string;
 }
-interface PrReviewResilienceCircuitRecord {
-    signature: string;
-    count: number;
-    contributors: Array<{
-        batchId: string;
-        laneId: string;
-    }>;
-    openedAt: string;
-}
+/**
+ * Issue #2382: the persisted circuit is a versioned union. The unversioned
+ * pre-#2382 shape migrates once to a nonblocking v2 record on first adoption
+ * (see `adoptPrReviewCircuit`); malformed records fail open.
+ */
+type PrReviewResilienceCircuitRecord = PrReviewCircuitLegacyRecord | PrReviewCircuitRecordV2;
 interface PrReviewResilienceStateRecord {
     policy: PrReviewResiliencePolicyRecord;
     attempts: PrReviewResilienceAttemptRecord[];
@@ -786,7 +786,6 @@ export declare class PrReviewResilienceRetryExhaustedError extends Error {
 }
 declare function snapshotPrReviewResiliencePolicy(policy?: PrReviewResilienceConfig): PrReviewResiliencePolicyRecord;
 declare function effectivePrReviewResiliencePolicy(state: PrWorkflowGateState, requestedPolicy?: PrReviewResilienceConfig): PrReviewResiliencePolicyRecord;
-declare function classifyTerminalFailureSignature(record: BackgroundDelegationRecord): string | null;
 interface EnforcePrReviewBaseDimensionsOptions {
     batchId: string;
     prHeadSha: string;
@@ -903,7 +902,7 @@ export declare function enforcePrWorkflowToolBefore(directory: string, sessionID
 /** Validate the terminal PR workflow contract before removing its durable gate. */
 export declare function completePrWorkflow(directory: string, sessionID: string, expectedMode: PrWorkflowMode, prHeadSha: string): Promise<PrWorkflowCompletionStatus>;
 export declare const _test_exports: {
-    classifyTerminalFailureSignature: typeof classifyTerminalFailureSignature;
+    classifyPrReviewCircuitSignal: typeof classifyPrReviewCircuitSignal;
     minimumConsolidatedLaneCover: typeof minimumConsolidatedLaneCover;
     analyzePrReviewBatchRecordIntegrity: typeof analyzePrReviewBatchRecordIntegrity;
     MAX_COVER_UNIVERSE_BITS: number;